To enable Kerberos authentication, you must make several Active Directory configuration changes to grant PingFederate access to the domain and add the domain to PingFederate.
Important:

Do not configure subdomains if the parent domain in the same forest has already been configured (see Multiple-domain support).

Note:

You must have Domain Administrator permissions to make the required changes.

  1. Create a domain user account that PingFederate can use to contact the Kerberos Key Distribution Center (KDC). The account should belong to the Domain Users group. We recommend that the password be set with no expiration.
  2. Use the Windows utility setspn to register SPN directory properties for the account by executing the following command on the domain controller:
    setspn -s HTTP/<pf-idp.domain.name> <pf-server-account-name>

    where:

    <pf-idp.domain.name>
    The canonical name of the PingFederate server.
    (For more information on "canonical name", see https://tools.ietf.org/html/rfc2181#section-10.)
    <pf-server-account-name>
    The domain account you want to use for Kerberos authentication.
    Note:

    When executing the setspn command, HTTP must be capitalized and followed by a forward-slash (/).

  3. Verify that the registration was successful by executing the following command:
    setspn -l <pf-server-account-name>

    This gives you a list of SPNs for the account. Verify that HTTP/<pf-idp.domain.name> is one of them.

    Note:

    After making an SPN change, any end-users already authenticated must re-authenticate (close the browser or log off and back on) before attempting SSO.